Recommended Free Tools
PowerShell failures that mention running scripts is disabled on this system usually come from an execution-policy scope, while Access to the registry key … is denied usually means the command tried to change the machine-wide policy without elevation. The fix is to identify the exact error, inspect every policy scope, and change only the narrowest scope that meets your need. Use an elevated window only for a LocalMachine change. If Group Policy sets MachinePolicy or UserPolicy, a local command cannot override it; an administrator must change the organization’s policy.
Why does PowerShell say running scripts is disabled on this system? Why do I get access denied when I run Set-ExecutionPolicy? This guide answers both questions and covers Windows PowerShell 5.1, PowerShell 7 on Windows, and PowerShell 6 or later on non-Windows systems. Microsoft’s policy definitions and precedence are documented in about_Execution_Policies.
As an Amazon Associate I earn from qualifying purchases.
Read the exact error before changing anything
Do not treat every UnauthorizedAccessException as an execution-policy problem. The command, resource, and wording identify different failure classes.
“Running scripts is disabled on this system”
This message indicates that PowerShell refused to run a script under the effective execution policy. It commonly appears when a script is blocked by a restrictive policy or when a downloaded script is unsigned under RemoteSigned. First determine which scope supplies the effective value; changing a lower-precedence scope may have no visible effect.
#1 Best Overall
“Access to the registry key … is denied”
This wording commonly appears when Set-ExecutionPolicy is attempting to write the Windows machine-wide policy without administrator rights. Omitting -Scope makes the target LocalMachine, so a normal PowerShell window cannot write that setting. The command itself may be valid; the account simply lacks permission for that scope.
Other access-denied errors
An error naming a file, folder, service, registry path, or another resource may be an ordinary Windows permission problem unrelated to execution policy. Keep the named resource and the command in view while troubleshooting instead of repeatedly changing policy.
Inspect the effective policy and every scope
Run these commands in the same shell in which the script fails:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Get-ExecutionPolicy
Get-ExecutionPolicy -ListGet-ExecutionPolicy reports the effective policy only. Get-ExecutionPolicy -List displays the value configured at each scope, allowing you to see why the effective value differs from what you expected. The scopes are evaluated in precedence order: MachinePolicy, UserPolicy, Process, CurrentUser, and LocalMachine. Group Policy scopes are administrator-controlled and take precedence over local settings. When Group Policy is not controlling execution policy, a Process value can temporarily take precedence over CurrentUser and LocalMachine.
| Scope | Duration and reach | Who can normally change it | Important behavior |
|---|---|---|---|
Process |
Only the current PowerShell process and child processes; discarded when they close | The user who started the process, subject to organizational policy | Useful for a one-session test; it does not persist |
CurrentUser |
Persists for one Windows user | That user, where policy permits | Does not affect other users or require a machine-wide change |
LocalMachine |
Persists for all users on the computer | An elevated administrator on Windows | The default target when -Scope is omitted |
UserPolicy |
Persistent policy for the user, delivered by Group Policy | Organization administrators | Overrides local CurrentUser and LocalMachine settings |
MachinePolicy |
Persistent policy for the computer, delivered by Group Policy | Organization administrators | Overrides local settings and cannot be defeated with a local command |
For example, a user may set CurrentUser to RemoteSigned and still see a different effective value because MachinePolicy or UserPolicy is populated. Conversely, a command that succeeds at Process scope affects only that shell. Always read the list after making a change so you can confirm which scope is winning.
Choose the narrowest policy change that solves the problem
Use Process scope for a temporary session
For a one-off script or a diagnostic session, set the policy only for the current process:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope ProcessThe setting disappears when that PowerShell process and its child processes close. It does not alter the user or computer policy, making it the least persistent local change. If MachinePolicy or UserPolicy is enforcing a value, the process setting cannot override it; inspect the list and involve the administrator instead.
Use CurrentUser for a persistent setting for one user
If you regularly run your own scripts and do not need to change settings for other accounts, configure the user scope:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUserThis is the usual per-user remedy on Windows when no Group Policy scope blocks it. It avoids writing the machine-wide registry location and therefore avoids the elevation requirement associated with LocalMachine. Confirm the result:
Get-ExecutionPolicy -List
Get-ExecutionPolicyMicrosoft’s PowerShell 101 guidance says: “Unless you’re signing your scripts, I recommend using the RemoteSigned execution policy.” That is Microsoft’s getting-started recommendation, not a guarantee that every organization permits it or that every script is safe.
Use LocalMachine only when all users need the change
A machine-wide change affects every user and requires an elevated Windows PowerShell or PowerShell 7 window. Start the shell with Run as administrator, then run:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachineBecause LocalMachine is the default when -Scope is omitted, this command has the same target:
Set-ExecutionPolicy -ExecutionPolicy RemoteSignedDo not use the second form as an accidental shortcut for a personal fix. If the command reports that access to the registry key is denied, close it, open a new elevated shell, and retry, or use CurrentUser if only your account needs the setting. Changing LocalMachine unnecessarily broadens the impact and requires administrative rights.
Fix a downloaded script without broadening policy
RemoteSigned can block an unsigned script that Windows identifies as downloaded from the internet. A policy change is not always necessary for that single file. First inspect the script’s contents and verify its source and behavior. Microsoft’s documentation states: “A best practice is to read the script’s code and verify it’s safe before using the Unblock-File cmdlet.”
Rank #3
After that review, unblock only the identified file:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteUnblock-File -Path .script.ps1Run the script again in the same directory. Unblock-File changes the file’s download-blocking metadata; it does not change the execution policy for your user, computer, or future downloads. Never use it as a way to make an unknown script run merely because a policy message appeared. If several files belong to a trusted package, review each file and the package’s source before deciding whether to unblock them.
Handle Group Policy and managed computers correctly
When Get-ExecutionPolicy -List shows a value under MachinePolicy or UserPolicy, that value comes from Group Policy. Those scopes override settings made with Set-ExecutionPolicy. A local command can report success while the effective policy remains controlled by Group Policy, so verify the effective value rather than assuming the command changed behavior.
There is no local syntax that legitimately defeats an enforced organizational policy. Contact the administrator or security team with the exact script, error text, and output of Get-ExecutionPolicy -List. They can decide whether the script should be signed, whether the policy should be adjusted, or whether an approved deployment method should be used. Do not advise users to delete policy registry values or bypass management controls.
Check which PowerShell you are actually running
Windows PowerShell 5.1 (powershell.exe) and PowerShell 6 or later (pwsh.exe) store execution policy separately on Windows. A policy set in one shell does not automatically become the policy for the other. If a command works in one window and fails in another, identify the executable first and run Get-ExecutionPolicy -List in both.
Free tools Windows power users keep installed
One-click scans. No signup required.
PowerShell 6 and later on non-Windows systems defaults to Unrestricted and cannot change execution policy. In that environment, an execution-policy fix is not the right explanation for a file-permission, interpreter, shebang, or operating-system security error. Use the platform’s permission and execution diagnostics instead, while retaining the exact error text.
Separate execution-policy failures from ordinary permissions
Execution policy governs whether PowerShell will run scripts; it does not grant access to protected files, folders, registry keys, services, or network resources. After policy inspection, retry the command and note what resource the error names.
Rank #4
- If the message still says scripts are disabled, compare the effective policy with the policy list and check for Group Policy.
- If the message names the registry key used by
Set-ExecutionPolicy, use an elevated shell forLocalMachineor targetCurrentUser. - If the message names a project folder or data file, request or correct that resource’s Windows permissions; changing execution policy will not help.
- If a script starts but then fails while opening a file, connecting to a service, or loading a module, troubleshoot that operation separately from the policy decision.
This distinction prevents a broad policy relaxation from masking an unrelated authorization defect.
A reliable troubleshooting sequence
- Capture the complete error. Copy the command, the first error line, and the resource named in the message. “Running scripts is disabled on this system” and a registry-key access denial lead to different fixes.
- Identify the shell. Determine whether the window is running
powershell.exe(Windows PowerShell 5.1) orpwsh.exe(PowerShell 6 or later), and whether the operating system is Windows. - Inspect all scopes. Run
Get-ExecutionPolicy -List, thenGet-ExecutionPolicy. Record any MachinePolicy or UserPolicy value before changing local settings. - Pick a scope deliberately. Use Process for one session, CurrentUser for one user, and LocalMachine only when every user needs the policy and you can elevate.
- Apply and verify. Run the scoped
Set-ExecutionPolicycommand, then repeat both inspection commands. If the effective value does not change, a higher-precedence scope is controlling it. - Address downloaded-file blocking. Review the script, verify it is safe, and use
Unblock-File -Path .script.ps1for that file instead of changing a broader scope. - Retry and classify the next error. If the policy message is gone but a file, registry, service, or network resource is denied, continue with that resource’s permissions rather than altering execution policy again.
Security decisions and practical examples
Running a trusted personal script once
Open the normal shell, inspect the current scopes, set RemoteSigned at Process scope if permitted, and run the script. Closing the window removes the temporary setting. This keeps the change limited to the task and avoids an administrator request.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Using scripts routinely under your own account
After reviewing the scripts and their sources, set RemoteSigned at CurrentUser. This persists for your account while leaving other users’ settings unchanged. If the effective value remains different, check for UserPolicy or MachinePolicy and ask the administrator rather than stacking more local commands.
Supporting scripts for every account on a shared Windows computer
Document the reason, review the scripts, and have an administrator open the shell with Run as administrator before setting LocalMachine. Tell affected users which executable—Windows PowerShell or PowerShell 7—they should use, because their policy stores are separate.
A downloaded vendor or community script
Do not immediately set a less restrictive policy or use a blanket unblock command. Read the code, verify the publisher and intended behavior, and unblock only the reviewed path if the file is trustworthy. If organizational policy forbids unblocking, follow the organization’s approved signing or deployment process.
Common mistakes that make the problem look worse
- Omitting
-Scopeunintentionally. The command then targetsLocalMachine, which explains a registry-key denial in a non-elevated window. - Changing the wrong shell. A successful change in
powershell.exedoes not automatically changepwsh.exe, and vice versa. - Checking only the effective value.
Get-ExecutionPolicycannot tell you which scope supplied it. Always pair it withGet-ExecutionPolicy -List. - Repeating local changes under Group Policy. If MachinePolicy or UserPolicy is populated, more CurrentUser or LocalMachine commands will not replace the enforced value.
- Unblocking before reviewing.
Unblock-Fileis file-specific, but it should be used only after checking the script and its source. - Assuming policy grants permissions. It does not authorize access to a protected data file, service, registry path, or network location.
How to document the issue for an administrator
When a managed computer needs help, send the complete error rather than a paraphrase. Include the command you ran, the script path, the executable in use—powershell.exe or pwsh.exe—and the output of Get-ExecutionPolicy -List. State whether the file was downloaded and whether you reviewed its contents. This gives the administrator enough context to distinguish a blocked script, a LocalMachine elevation problem, a Group Policy decision, and an unrelated resource permission.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsDo not remove policy entries, edit policy storage directly, or recommend a broad machine-wide change simply to make one script run. An administrator may instead require a signed script, approve a deployment method, adjust the managed policy, or tell you to use an approved shell.
Reference documentation
For scope precedence, Group Policy behavior, and policy mechanics, see Microsoft’s about_Execution_Policies. For LocalMachine defaults, elevation, platform distinctions, and the Unblock-File example, see Set-ExecutionPolicy. Microsoft’s error-reading and permission-denied examples are in Getting Started with PowerShell – PowerShell 101.
Frequently Asked Questions
Why does PowerShell say running scripts is disabled on this system?
PowerShell is refusing the script under its effective execution policy. Run Get-ExecutionPolicy -List and Get-ExecutionPolicy in the failing shell to find the controlling scope. If a downloaded unsigned file is blocked under RemoteSigned, review it and consider Unblock-File for that file only.
Why do I get access denied when I run Set-ExecutionPolicy?
If you omit -Scope, the command targets LocalMachine. On Windows that machine-wide setting requires an elevated shell. Open PowerShell with Run as administrator, or use -Scope CurrentUser when only your account needs the setting.
Which scope should I choose?
Use Process for a temporary current-session change, CurrentUser for a persistent setting for one user, and LocalMachine only when all users need it and an administrator can elevate. MachinePolicy and UserPolicy are controlled by Group Policy and take precedence.
Why did Set-ExecutionPolicy succeed but the effective policy did not change?
A higher-precedence scope is probably supplying the value. Check Get-ExecutionPolicy -List for MachinePolicy or UserPolicy. A local command cannot override an enforced Group Policy setting.
Is Unblock-File safer than changing execution policy?
It is narrower because it changes the download-blocking metadata for one file instead of changing a user or computer policy. Still, inspect the script, verify its source and behavior, and unblock only a file you trust.
Will changing execution policy fix a denied project file or registry path?
No. Execution policy governs whether PowerShell runs scripts; it does not grant access to protected files, folders, registry keys, services, or network resources. Troubleshoot the permissions on the resource named in the error.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why does a policy change work in Windows PowerShell but not PowerShell 7?
Windows PowerShell 5.1 uses powershell.exe and PowerShell 6 or later uses pwsh.exe. On Windows they store execution policy separately, so inspect the scopes in the executable where the script actually fails.
Can I change execution policy on non-Windows PowerShell 6 or later?
PowerShell 6 and later on non-Windows systems defaults to Unrestricted and cannot change execution policy. A failure there usually requires platform-specific file, interpreter, shebang, or operating-system permission troubleshooting instead.
The Bottom Line
Start with the exact error, then run Get-ExecutionPolicy -List and Get-ExecutionPolicy in the same shell. Prefer Process for a temporary test and CurrentUser for one user. Use an elevated LocalMachine change only when every user needs it. Review downloaded scripts before using Unblock-File, and involve an administrator whenever Group Policy controls the result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
